December 2003 - cypherpunks-legacy

17 Dec '03

Thank you all for you comments and input. I am in the process of rewriting the propsal to make things clearer, and to revise some of the procedures. The original draft will, and the revision will be up at <http://www.bounty.com/proposal.draft.html> by the time most of you get this. I am making a single reply, rather than one at a time to save time and bandwidth. I wrote these replies before I started working on the revisions to the proposal, so things might have changed a bit. Matt: > > This mechanism should be as simple as possible, and as easy to use as > I assume you will make it all web based? Make sure you are using a Yes. It is going to be web based, with (hopefully) email and Usenet access. > secure server. Pay close attention to security of the underlying OS. I am planning on using Apache-SSL or Stronghold, if I can afford it, with Linux as the underlying OS. I plan on disabling telnet access as soon as the server starts accepting credit card numbers. Anyone who then need shell access will have to use SSH. > > Originally I proposed this to apply to software, but I don't see why > > it should stop at software. Initally the server will be restricted > > to software, but I hope that this will work out, and be expanded > There is no reason that it should only apply to software, so I am > glad you are thinking this way. Realize that your costs will go up Software is my main objective, and software is easier. > if you applythis to non-software related industry. You may need to > hire experts in other industries, etc. Of course, it may all pay off > anyway for you. Yeah. There is that. The other technologies I was thinking of were more in the realm of algorythms and protocals rather than hardware. Hardware is possible, but difficult, and may (would) be better suited to Ian's proposal. >> The proposal: >> What I am going to attempt to do is to set up a "Bounty Server" where >> send their initial "bid" to the organization. > Presumably web forms that generate a standard piece of output so that > developers dont have to sift through "original" specs. I have > questions about bids, but ill get to that later. Prozactly. >> This is the "bounty". Other people can add to this bounty, allowing the >> and the server operators. Other technology will be figured out as it >> becomes necessary. > You will need to make several things clear here. When people "add" <snip> > not. It is not impossible to solve this problem, it just takes a bit > of good wording in the Contract. I understand that. If you are willing, I will ask for your opnion on the wording. >> The initial bounty contract gets posted to the WWW server, (possibly) to >> a "developers list" of interested people, and (possibly) to an >> appropriate UseNet Newsgroup. >This may not be a popular point but you asked for legal tips >(/disclaimer BTW, this is not to be relied upon as legal advice. I am > giving it only to make you aware of some issues that you may want to look > into.disclaimer/). You need to be aware of possible discrimination > claims. There is a theory called disparate impact which you may have > a problem with. You should find a way to distribute these > announcements as widely as possible. This is a tricky area and one > you should be aware of. The final decision, of course, is yours. I don't really understand this. I plan on spreading the word as far as possible, but if I only post information in one or two places, isn't that my choice? If I am tryind to hire someone am I required to place adds everywhere I can, or can I choose my medium? >> Once the bounty is posted, other people can "bid up" or add to the bounty, >> and their contribution will be added to the total bounty as well as their >> accepted by credit card, check, money order, and possibly ecash >> (e-cash will be taken at some point, but it really isn't important >> at this point since almost no one uses it.) > > It would be good to accept ecash and maybe contact MarkTwain to see > if you can set up discount accounts for your developers. The people > involved in this project would be familiar enough to give the system > a boost. Why do you think the amount people give is not relevant? I wasn't refering to the amount, but rather ecash being not-relevant AT THIS POINT <runs and hides behind asbestos sheild> Not many people have ecash accounts, so it isn't a priority. It would be nice tho'. As to the amount: It really doesn't matter, but I am thinking of making a minium of $5, just because anything less really isn't worth the book keeping, but I really haven't made up my mind. >> The first developer to upload a _working_ package to the server will >> be cut (or ecash mailed if that works out). > Why do you think you need to keep an archived copy? If you deal with > Copyrighted material you MUST get a license up front. That shouldnt > be a problem for you since the developers are benefiting, but I am > just curious as to your thought process here. Archival copies are for legal reasons. Copyrighted material other than that uploaded by the authors is not going to be allowed, and part of the agreement is that they allow the Server to keep a copy for historical/legal reasons. >> The Server Adminstrator will also do an cursory check to make sure that >> there are no obvious copyright violations. > This needs to be much more than cursory. If you put a copylefted > piece on an open ftp site and it winds up to be copyrighted guess who > could get named in the suit. Not only should you vigorously research I will have the name of the submitter, and I will make a "good faith" effort to detect copyrights. I think that is enough. I don't (in fact I doubt any one person does) have enough knowlege to know every peice of software out there. I am more worried about people decompiling commercial products. >> In the event that there is a conflict between the initiator and the >> developer, the claim will go into adjudication. The server adminstrators >> decesion is final, and he will make every effort to settle the claim >> fairly. Adjudication will incur an additional fee (see the fees section). > appearance of impropriety is important but more important to you is > the need to have someone other than yourself to blame. You dont want > to be held responsible for an "anti-developer" decision if you dont > have to. I am hoping that reputations will handle this. > > Writing the bounty: >> The bounty specifications should include the following: >> else will contribute), owned by the programmer (well someone might >> be that magnanomous), or "copylefted". > > This will be up to the writer. It might not be a good idea for the > initiator to have input here as it will be a wedge causing more > adjudication than it is worth. I disagree. The iniator (hence forth known as Alice) is establishing the rules, it is up to that person to set forth the conditions. If the writer doesn't like it, they don't write it, and Alice looses her money. If enough people add to the pot, someone will bite, and Alice gets what Alice wants. >> 6) Where the initiators money is to go if the bounty is not claimed: >> choice. > Why not give it back to the initiator (minus a fee for the > opportunity). While I am sure you have good charities in mind, > people on the net dont like being forced to do anything. Keeping the > charity donation as an option is a good idea. To keep Alice from reniging once the money is given, it is gone. It means that you have the choice of software or nothing. > > Adding to the bounty: > > Fees: >> The Organization will get 2% of any bounty where the software or >> Technology that is copylefted. 20% of any other scheme. > 20% seems steep. You might want to at least start out with a > discount on this percentage. I like the discount for copylefting. 20% is an 18% penalty for not Copylefting the software. It means that I am going thru a lot of work, and not getting what I want, so I am going to get something. I want this server to produce Free Software. >> Adjudication will incur an additional fee of 2 to 5% depending on the >> difficulty in judging the claim. > This needs to be a certain percentage not a range. If need be assign > it via hourly charges. It is not easy to get people to stay out of > also encourage you to include the amount in all of the bids. You can > spread exposure and lower the rate. You are probably right. I really want to charge each equally. > > Where I need help at this point: >> Legal issues. Any lawyers want to talk to me about this? > Let me know if you have any questions. None of this is legal > advice...blah,blah,blah. Fine. > Looks like a good start. Keep me informed. Thanks. ========================================================================== Omegaman: >> The objective is to actually bring this system online. > "cypherpunks write code." good. Soemthing like that. > > Background: >> graphics editing software, easy to use Graphic Design Software (TeX >> is NOT easy to use) and easy to use Cryptographic software. > many would pay good money for Linux native versions of programs like > Wordperfect, Corelpaint & draw, Pagemaker , etc. I think "pay for" might be a little strong a word. "Assist" is more accurate. >> 4) Desired "quality" level: Proof of Concept, Alpha, Beta, Release etc. > Needs flesh. What defines "alpha" or "beta" for purposes of bounty > or is that up to the person initiating the bounty? If I can find good working defininations (sp?) I will use them. Otherwise I will insist that Alice document what it wants. >> 6) Where the initiators money is to go if the bounty is not claimed: >> honest, as well as the server. Each contributor will also get this >> choice. > Do you have the charities in mind? They should be listed in the > abstract, I think. March of Dimes, NORML, NRA, ACLU, GNU Foundation, FSF, SPLC. As the time gets closer this will get more exact. > Who will be publicize the initial bounty offer -- the server or > bounty initiator? Information about a specific software project will > need to be disseminated beyond bounty.org. Automated positing to relevant newsgroups, and maybe a mail list for those interested. > More details on conflict resolution are needed in a final draft. The > process and priorites the server administator will use to make his > specific hypotheticals detailed. Ok. ======================================================================= Peter Allan: > Snow, I know, Spell Check. >> Abstract: > "new technologies" doesn't seem to be what you mean later on. > I suspect you will get _higher_ overheads with this. For instance > suppose 2 people start work on something, and one wins the bounty, > the other goes unrewarded. To compensate each coder for this risk That is life. First to market means a lot. Look at Lotus. I am contemplating adding in a place for developers to meet and collaborate, sharing the bounty. >> community of users to decide which projects should have priority, >> and which shouldn't. > Hmmm. What about people ahead of the game - like PRZ. He get a VC or two and goes commercial. >> award to be paid to the developer. They then post it on the server and >> send their initial "bid" to the organization. > > Where is the scope for iterative discussion of the spec ? > This is _the_ killer stage for most work. This is Alices responcibility. >> This is the "bounty". Other people can add to this bounty, allowing the >> totals to add until someone claims that bounty by providing proof of > What about proof to the satisfaction of other contributors ? > How do I know Bill and Ben aren't cheating by starting and claiming > a bounty to which I contribute ? (Bill and Ben are fictitious in this > example. <g> ) Good point. Solututions? >> I will provide a short (8 or 10) list of charities that the money >> honest, as well as the server. Each contributor will also get this >> choice. > How does this keep anyone honest ? Keeps them from reniging (sp?) on the bid. =========================================================================== Ian: > Hi, Snow, >> I have started drafting a proposal statement for the Bounty server. > Wow, you've gotta move fast in this game :)) If I don't keep the inertia up, I will never get it done. > [chop where agreed or not disagreed] > > Background: >> It is the "Copylefted" software that interests me at this point. > OK, although for my model, I am assuming that all forms are covered. As I pointed out in private email, I think our model serves different objectives. > > The proposal: >> What I am going to attempt to do is to set up a "Bounty Server" where >> someone can iniate a "bounty" on a peice of technology. The initator > Separate this out, for clarity of model. The initiator (I used > Proposer, and called her Alice coz Alice always initiates) proposes I will do that. > BTW, bid to do what? Using market terminology, I have assumed thay > bid is to buy, that is provide cash. Offer is to sell, that is provide > software. Ah, yes, bid is add to bounty. Think if it as a bet. Kinda like Mr. Bells AP proposal, Alice is betting that the software _won't_ get written. Once the bet is high enough, it _will_ get written. >> This is the "bounty". Other people can add to this bounty, allowing the >> development to the initiator of the bounty. In software terms they would >> and the server operators. Other technology will be figured out as it >> becomes necessary. > This is where I have put most of my efforts, because I need to design the > microstructure that is built into our market. I am going to try to keep it simple, and let the thing evolve as necessary. As Alex (a former reader of this list) put it, the first anonymous remailer was a perl hack done in an afternoon, and improvements came from that. Things will improve as needed, I am just trying to think things out as thoroughly as possible first. >> Originally I was going to put the stipulation in that the software written >> rather simply desired. To aid in that desire, I am going to build in >> an initative to releaseing the software "copylefted". > Absolutely - let the market decide. Some of us, for example, do not like > copyleft. What do you have against "copylefted" software? Is it the specific GNU copyleft, or the concept? > > To get more specific: > [chop] >> The first developer to upload a _working_ package to the server will >> be awarded the total bounty, ... > This worries me. If I, as a junior programmer, am looking to enter the > market, I will have the daunting task of beating everyone else. Real life > doesn't work that way - there are ways in which I can pick up some newbie > tasks for low money, so as to build up experience and/or reputation. 1) As a junior programmer, you take on simpler bounties first. 2) Team up with a more advanced programmer, pool efforts and split the bounty. > I guess the notion of bounty is just that - first one takes all. > However, I think that the solution might be a bit limited in the > long run. It isn't intended to solve all problems, just some. > Interesting in that my proposal leads to task distribution by awarding > contracts, your proposal leads to task incentives by rewarding speed. Yours seems suited for longer and more involved tasks. Mine to shorter. >> "First" will be soley determined by the time stamp of the server. As soon >> as the package is uploaded, the initiator and the server adminstrator >> will be notifed, and the bounty marked "claimed". If the package is >> be cut (or ecash mailed if that works out). > OK, my proposals specifically assume no need for a "decision" by Alice. > That's not to say either is right, it's just that I prefer to design > something that eliminates the individual decision rather than cope > with the complexities. I believe it will result, in the end, in a > more efficient market. It might be more efficient to have a "paid" staff to evaluate the product to make sure it meets the specs. I don't have the funds to set up that infrastructure. >> The Server Adminstrator will also do an cursory check to make sure that >> fairly. Adjudication will incur an additional fee (see the fees section). > Same as above, no adjudication in my system. > Although, it is possible to add underwriters, > by simply making the task offerers (Bob and Carol) > into bond writers who front for programmers. I am hoping that it doesn't come up too much. Honesty and reputation should help. > > Status: >> At this point in time I am (obviously) still in the process of developing >> the procedures. I have registered a Domain Name (bounty.org) and I have >> a couple promises off assistance in certain areas. As well, I have >> a server to start off with. > Wow, *gotta* move fast. As I say, our stuff is based on a lot of > pre-existing software, so we make a lot of assumptions. Given our You are starting with the software, and then figuring out the rest. I am doing it the other way. > different approaches we may end up with competing systems rather > than one, but that's fine, indeed highly valuable as an experimental > approach. I don't think that the two proposals will necessarily compete. > What's financing you in this? Or should I say, monetarily enthusing? Financing? ======================================================================== Blake: > I missed the original discussion of this idea, but it sounds delightful to me. > A couple of thoughts on your most recent post: > What counts as a copyleft should be explicitly defined, i.e. just the GPL, > or how about Perl's artistic license... or Aladdin's GhostScript agreement? Ok. I will put up examples of each, and let Alice choose. > Public domain software should incur no larger percentage fee than copylefted > works. True. > How is the expiration for a bounty determined? I am thinking either 2 years after initial, or 12 months after last contribution, With a 1 year one time extension if someone claims to be "working on it". > Adjudication fees should be split in some fashion between parties. (Otherwise > the initiator has nothing to lose from disputing. (Unless of course you'd > like to > handle that on a reputation basis.)) I am hoping that reputation and the threat of adjudication will prevent it from happening. That is one area that does need work tho'. ========================================================================== Jim Cook: > be awarded the total bounty, minus "brokerage" fees (discussed later) > "First" will be soley determined by the time stamp of the server. <SNIP> I don't like this way of picking a winner ... because I think it would encourage fast and dirty work ... instead of quality ... better I think would be a process analogous to peer review for grants and publications ... with the added feature that the submission of a product is announced ... so that competitors who are almost done can get their entry in also ... and the initiators can evaluate several products simultaneously <SNIP> My reply: In a way it _does_ encourage quick and dirty work, like the first cpunks remailer, hacked together in an afternoon, then came the rest. It is a way to get _more_ software out there, hopefully some of it will be good, some bad. It really can't be much worse than the dreck comming out of some of the commercial houses. I am thinking of a way of implementing checks tho'. ===================================================================== Thanks for the comments. Keep them coming. The original draft will be up at <http://www.bounty.com/proposal.draft.html> later tonight.

1 0

re:PGP263UI
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back posted re PGP 2.63ui >I was under the impression that with the Legal_Kludge option for >pgp263i, that it already was compatible with old versions of pgp using >the version byte of 2. We kept the control structure of the original ui version by "Matthew". But the compatibility of 2.63ui has been expanded to allow it to Export public keys generated with Version=3 (Legal_Kludge=on) to old versions (2.3a) of PGP. >What else does pgp263ui offer? The GNU license? What about pgp3? >Some people aren't going to be very happy if you do a GNU version of >that, as GNU doesn't preclude selling commercially provided that >source is provided. See the original announcement for the numerous fixes & enhancements not currently available in 2.6.2 or 2.6.3ia including Added CONFIG.TXT parameters/functions LabelEncrypt and PrePendSigV Expanded disk write error checking Ability to edit other people's keys's UserID's. We have no current plans re PGP 3.0. Probably a GNU version of it is not legally possible. But if source is released independent enhancements would be, depending on the license. It also remains to be seen if or how fast PGP 3.0, if it ever comes, will supplant previous versions of PGP in public acceptance. >PS Steve and friends: I've got some stealth code close to usable in >the form of a patch to pgp263 if you want it :-) Yes. Please send me a copy and we'll take a look at it. But the external stealth utility currently available is quite adequate in my view. Steve Crompton <sunray(a)globalnet.co.uk> -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQEVAwUBMp11UxRHWQsRmI2RAQE/EggAwtnT312Wmi7dWn4sYK/GxVJDqbKpuGuh yVekVPRsrBRQlhcQqm1ICzucGMOd+uDNTNqoxx82tBzjAphN2adANayin3I7FpW1 mkvdCj77pzkEwqc60OcPjqRg5q9xKsPCczAmaHBVmuyKjCDJemEzLMUQsrllohha c3v4WcRgB+epnDpF0hpdDYH7aiIo/FmN59ItcMEvrytkt5Hv7GjZq974UC/1ALik sFsML7QWp6bpVNzDeE8H7FmrT7kKVBddQwQcwFP2dPHOaFdqMRPjVcIxxjiOs5/o I3sCaH8L5VAF/WivcRCvYOBV+kklbTQsJIdt/eTrCGtTpoWtjVhyyw== =VPSl -----END PGP SIGNATURE-----

1 0

Re:PGP263UI
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mark M. (markm(a)voicenet.com) wrote on Sat, 23 Nov 1996 22:24:41 -0500 (EST) >... >> Note that I personally have not done very much of the actual coding on >> this version. However if bugs are reported or constructive >> suggestions for improvements made I will pass them on to the >> individual(s) who have done the bulk of the work to make this release >> possible. I am assured that continuing support will be provided. >I found two bugs so far: > >This version doesn't recognize either .pgprc or pgp.ini as valid >config file names. It is very minor, but this functionality is >stated in the manual. I couldn't find any mention of either filename in -our- docs. Please point out the reference if I missed it. I think this was an MIT "feature". I don't plan to copy it. >One of my favorite options, +makerandom, isn't supported in this >version. This is an undocumented option, but it is useful in >many situations. Not as useful as you might think. A bug has been reported in the MIT version that +makerandom produces -weak- pseudo-random output, as (I am told) can be verified by just generating a large "random" file and viewing it with a hex viewer, looking for regular patterns. I don't know if this was ever fixed in Stale's version. This bug does not produce a weakness in the normal functions of MIT or Stale's PGP. MIT heavily rewrote the random number functions for their versions of PGP and the +makerandom feature depends on this rewrite. I did not want to try to import "mass quantities" of code from MIT both to respect their copyright and to maintain to some degree the independence of the MIT-derived and 2.3a-derived versions to that a bug in one might not be reproduced in the other. For Random numbers up to 24 bytes (192 bits), just use a -copy- of RANDSEED.BIN. For a longer random file, just encrypt (either RSA or conventional IDEA) a file a little longer than the file desired. Throw away a few hundred bytes from the start and end. The result will be just as strongly random as +makerandom even without the current bug. >This version uses +version_byte instead of +Legal_Kludge, but I >consider that a feature. I haven't had time to experiment with >the "Charset:" header. One other minor problem is that >ClearSig doesn't default to "on". This could cause some >frustration with new users. I haven't tried to imlpement the "Charset" header and probably won't. If this feature is important to you, use Stale's version. I will look into this for the next version, but no promises. Clearsig is working correctly as we document it. Another MIT change. It would be more work to change the documentation than the code, but I will consider this for the next release. >Other then that, it's just fine. Thanks for your constructive criticism and comments. Steve Crompton 100645.1716(a)compuserve.com (preferred) -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQEVAwUBMp14FhRHWQsRmI2RAQHndggAgNdcOqya2NPX+8KOkoj1qoYnGBRprREK t0l3sK2HHqUQwTwKSkW5ugD898kG26HjCVlMsqfgQVcw+3nAhZgU/t7MCU9/orD8 yUc9vtXr/C4lLJHTtDGVpjPfRAJpV0m0myDwoqXZo4gTrkoQG43mKaE4eLv9qcl4 zGv4fMv/lh7hUwfUsZ6c7ULGPfKeYtknO1Hh3gKYX6HJPz5Qki2toIdH8qxpw51v CC/Q/MLxLQUGYH/jdHqvUSSD0G1QIu/D/LlL9VaUtPJemqPOuBGmk+ywvE7AAfNG uEnO/AumU3j1yPnFXqv5pUKGxP1gKbMyKR8lrEwWcrDapaiC6mW4oQ== =qk2B -----END PGP SIGNATURE-----

1 0

Re: IQ and age
by Lurker 17 Dec '03

17 Dec '03

At 10:47 PM 11/27/96 -0600, Igor Chudov @ home wrote: >Dale Thorn wrote: >> The biggest influence on IQ are the so-called "engrams" (fears, super- >> stitions, anxieties, etc.) planted in your brain early in life. >> >> Some of this can be overcome with mental exercise, and awareness of what >> negative influences are holding you back. Much easier said than done! >> >> IQ as they attempt to measure it can probably be most easily explained >> as pattern matching skills. Unfortunately for testing, and although you >> can be every bit as intelligent at 70 as at 10, your pattern-matching >> skills change and evolve over time, so any given tests will only apply >> (more or less) at the age group they are optimized for. >> > >Would you dismiss strong correlations between IQ and success in life >and academia as something irrelevant? > I would. If you look at who has the oppertunities to go college you will note that those who are good at taking tests (SAT, ACT, or IQ) are those who get to go. You will also note that money also breeds success, or can someone give me an argument for the fact that there are more rich kids going to Harvard, Yale, Stanford, and the like than poor kids. (These schools almost gaurentee success.) If you want to find a correlation look for it in money not tests. And if you are insistant on finding it in tests, ask why the scores are as they are (was the test written to the advantage of one group over another or can one group buy the "A" with special courses which teach the skills needed to score high.)

2 1

Eudora/PGP Plug-in--Free
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Eudora/PGP Plug-In Download version 0.20 from the Web: * http://www.prism.gatech.edu/~gt6525c/eppi/epp16_02.zip (for 16-bit version of Eudora 3.0 for Windows 3.1) * http://www.prism.gatech.edu/~gt6525c/eppi/epp32_02.zip (for 32-bit version of Eudora 3.0 for Windows NT/95) If you don't have Web access, but have FTP access, try the following sites. Note that if the version you are trying to get was released today or just a few days ago, it may not have shown up at the sites below yet, so give it a few days: papa.indstate.edu: /pub/winsock-l/mail/epp16_02.zip /pub/winsock-l/Windows95/mail/epp32_02.zip /pub/winsock-l/WindowsNT/mail/epp32_02.zip ftp.winsite.com: /pub/pc/win3/winsock/epp16_02.zip /pub/pc/win95/winsock/epp32_02.zip If you want to be automatically notified of new versions, send e-mail to gt6525c(a)prism.gatech.edu with the subject of "eppi news", and the following message body: join stop

1 0

More anonymous hate mail from John Gilmore, Timmy May, and friends
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've received the following e-mail from an anonymous coward. It didn't have any carriage returns (I added them). >Date: Thu, 28 Nov 1996 09:23:00 -0700 >Message-Id: <199611281623.JAA03709(a)zifi.genetics.utah.edu> >To: dlv(a)bwalk.dm.com >From: nobody(a)zifi.genetics.utah.edu (Anonymous) >Comments: Please report misuse of this automated remailing service to <complaints(a)zifi.genetics.utah.edu> >Subject: Yo, Kook! Read this. > >... > >>"Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> writes: >>> Actually the opposite is the case, he is a notorious womanizer. >> >>Are _you gay, Phil? > >Look, Kook. Can you at least wait 24 hours after complaining about eliptic >curves being somehow off-topic (as I recall, it was 50k rants about Armenian >genocide that got your dumb ass booted) before posting your own off-topic >sewage? Who gives a flying fuck who is or isn't gay or perverted or whatever >in their private lives? What does it have to do with crypto, or proficiency >in programming, or anything that matters to most of the list? It seems to me >that you should try casting your "pearls" before the much more "noble" >animals of the freedom-knights, who (as opposed to me) _DO_ care who is or >isn't homosexual. Get back on your meds, it'll do you (and the list) good. > >me One of the meanings of "punk" is "young homosexual". There are a lot of them on the "cypherpunks" mailing list, trying to be social and to make friends. They think that the "cypher" part is "kewl" and even rant about it, without understanding the meanings of the technical terms they use (like the recurrent rant about brute-force attacks on one-time pads). But they don't know much about cryptography, so when someone, e.g., tries to talk about elliptic curves, the "punk" crowd screams that it's "off-topic". Today is Thanksgiving, so I hope you choke on your turkey (or whatever else ends up in your mouth :-). I'm thankful that I wasn't born in this country, because Americans are so stupid.

1 0

RE: Re: wealth and property rights
by William H. Geiger III 17 Dec '03

17 Dec '03

In <199611281157.DAA12088(a)infomatch.com>, on 11/28/96 at 04:53 AM, "Murray Hayes" <mhayes(a)infomatch.com> said: >On Wed, 27 Nov 96 10:16:20 -0500, William H. Geiger III wrote: >>In <009ABBF7.ACB06A80.64(a)SPRUCE.HSU.EDU>, on 11/22/96 >> at 12:18 PM, jc105558(a)spruce.hsu.edu said: >> >> >>socialism uses FORCE to take what it wants while the capitilism you have a >>free & volintary exchange. >> >>why is this so hard to understand?? >> >Don't be an idiot. Socialism has nothing to do with force. It is an >economic system not a military stance. >Communisist belive: >>From each according to there abilities >To each according to there needs. >Socialist belive: >>From each according to there abilities >To each accoring to there contirbution. >They are very similar, BUT HAVE NOTHING TO DO WITH FORCE!!! >Some countries have very socialized systems with democracy. Those people >want socalized everything. The US is socialized to a very small degree. >The UK is socialized to a further degree. <sigh> socialism has EVERTHING to do with force. Socialism is based on the TAKING from one to give to another. Without FORCE or the threat of FORCE most people will not allow their hard earned property to be taken away from them. You look at any socialist program in the "democracies". Every one is a) Manditory b) Backed by FORCE. No socialist program has ever been implemented on a large scale without the use of FORCE. It just can't work without it. I do not wish to be part of the socialist programs in the U.S. Medicare, Medicaide, Welfaire, SS, WIC, FoodStamps, ...ect. It is only because of the threat of the use of FORCE against me that I continue to pay for such programs AGAINST MY WILL. This is the same everywhere. If these were programs that the majority were willing to participate volentary then why are they Manditory?? Why use the FORCE of government to implement them?? Because socialism is THEIFT and people naturally resist the theift of their property. -- ----------------------------------------------------------- "William H. Geiger III" <whgiii(a)amaranth.com> -----------------------------------------------------------

1 0

Whitehouse Releases Blueprint...
by null＠void.gov 17 Dec '03

17 Dec '03

Notably, the emphasis is on the needs of business, not "people." We are in an excellent position to observe and document the process whereby "business" -- that is, organizations motivated primarily, if not exclusively, by the desire for short-term profits accruing to vested interests -- comes to dominate and control a technology. The auto and television industries come to mind as two prior examples. We are about to see the net go the same way. Take notes. "I have to praise the administration and Ira for reaching out to the private sector for comments," Computers and Communication Industry Association President Ed Black said. "There's a great emphasis on the needs of business here." Even so, privacy activists remained disappointed with many of the document's features. "This isn't anything new," said David Banisar, counsel to the Electronic Privacy and Information Center. "The privacy stuff is terrible. They say it's market driven, but markets don't work with privacy. It's like what happened with P-Trak."

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by geeman＠best.com 17 Dec '03

17 Dec '03

At 07:12 AM 11/27/96 +0000, you wrote: .....etc Can you be more specific? What are the vulnerabilities you are aware of? >I've never seen a security review of SSLeay, and if anyone gave it a clean bill >of health, they didn't have their eye on the ball. Note, I'm not knocking >SSLeay here, it is a wonderful lump of code, but it hasn't been written with >security in mind (IMHO). > >Cheers, > >Ben. > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

3 4

RE: IQ and age
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Clay Olbon II <olbon(a)ix.netcom.com> wrote: >Seriously, you ignore the correlation between performance in college and standardized test scores. There is a reason these are used in admissions - they are actually pretty good predictors of the ability to perform college level work. < This is a commonly held fiction that is not supported by the evidence. As stated in another message, the infomration given out by ETS, who administer the GMAT and SAT, indicate that there is a low correlation between GMAT scores and successful completion of even first year education programs. This also ignores the issue of why other, better, widely available predictors are not used instead. >Oh, I forgot. Only certain racial/ethnic groups are capable of understanding basic mathematical concepts. < There was a good Scientific American article on cultural influences on learning within the last year or two. It examined Asian groups noted achievements in tests and the parental and cultural support for scholastic achievement. Another anecdotal example is in the opening chapters of "Surely You're Joking, Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon vivant. He describes how his mother introduced a doctor, a general and a professor with the same respectful tones indicating to him that a career in academia was as highly valued as any other high position in society. >I happen to feel better believing in the potential for any individual in this country to succeed through hard work. < I do to. But how good are your feelings as predictors of actual success? James

3 2

RE: IQ and age
by Clay Olbon II 17 Dec '03

17 Dec '03

At 12:40 PM 11/28/96 EST, jbugden(a)smtplink.alis.ca wrote: >Clay Olbon II <olbon(a)ix.netcom.com> wrote: >>Seriously, you ignore the correlation between performance in college and >standardized test scores. There is a reason these are used in admissions - they >are actually pretty good predictors of the ability to perform college level >work. < > >This is a commonly held fiction that is not supported by the evidence. As stated >in another message, the infomration given out by ETS, who administer the GMAT >and SAT, indicate that there is a low correlation between GMAT scores and >successful completion of even first year education programs. This also ignores >the issue of why other, better, widely available predictors are not used >instead. Apples and oranges. I was referring to the correlation of college GPA to SAT scores (which is higher than the correlation between high school GPA and college GPA). GPA measures the ability to do college-level work. As such, SAT scores are very relevant. As you said, <completion> of college probably does involve lots of other factors. I would not expect a high correlation between standardized test scores and completion rates. > >>Oh, I forgot. Only certain racial/ethnic groups are capable of understanding >basic mathematical concepts. < > >There was a good Scientific American article on cultural influences on learning >within the last year or two. It examined Asian groups noted achievements in >tests and the parental and cultural support for scholastic achievement. My point exactly. It is these cultural factors, not the amount of money the parents make, that is really the important aspect. It does seem unfortunate however that in many lower income families, there is less of an emphasis on scholastic achievement. >Another anecdotal example is in the opening chapters of "Surely You're Joking, >Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon >vivant. He describes how his mother introduced a doctor, a general and a >professor with the same respectful tones indicating to him that a career in >academia was as highly valued as any other high position in society. > >>I happen to feel better believing in the potential for any individual in this >country to succeed through hard work. < > >I do to. But how good are your feelings as predictors of actual success? Anecdotal evidence, but I have known people at many levels of society. I have never met anyone who "works hard" that is in dire straits. Some have struggled for a time (I know I did!), but eventually the hard work paid off. Clay

1 0

Fwd: Re: wealth and property rights
by Murray Hayes 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996 10:54:51 -0800 (PST), Dave Kinchlea wrote: >On Wed, 27 Nov 1996, Clay Olbon II wrote: >> >> This is provably bullshit. Look at the HUGE numbers of people in this >> country who make the economic decision to do nothing and go on welfare vs. >> going to work. Examine carefully the economic performance of the US vs the > >I don't know how much people get on welfare in your country but I >suspect that it is even less than in this country (Canada). Anyone who >truly believes that people make the `economic decision to do nothing and >go on welfare vs. going to work' has, in my opinion, no &^%* idea what >they are talking about. Just try to *live* on a welfare wage for a few >months to see how silly this thought is. While there may well be a few Hmmm, only a few years ago the Finacial Post did a report on welfare in Ontario. The maximum benifit package (for two adults, two children or something like that) came to about 34 000 dollars. YES 34 000 dollars. Actually, the figure the Post published was wrong. Welfare Ontario said they were a couple of hundred dollars UNDER the true value. Of course that isn't all in cash. It comes as subsidies houseing, free diapers, free baby food...... Are you telling me that it would be hard to live on 34 grand? I wasn't aware that our dollar was so weak.... And then there is the B.C./Alberta fiasco. The final check welfare recipients get in Alberta just happens to be the exact amount it costs to buy a bus ticket to B.C. The B.C. govn't gave up ALL federal funding of their welfare program to impose a rule that required 3 months of residence before benifits would be given. I don't even want to start talking about the newfys. What it comes down to is this. Eventually we as a society will have to make a choice. We will have to chose between hurting the people who work and hurting the people who don't work. You can't have it both ways. IF you MUST make the choice, who will you choose? mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

1 0

Re: First Contact
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: allyn(a)allyn.com, cypherpunks(a)toad.com Date: Thu Nov 28 23:40:50 1996 > I think that the character Data uses either PGP or some > sort of crypto system to lock up the ship's computer. The term used is "fractal cypher." It's not a terribly significant plot point IMO (although, for longtime fans of ST:TNG, there is some juicy humor with Data and the Borg "Queen" when she tries some, er, unconventional tactics to try to get him to reveal it.) > At least if you spend any reasonable time here in > cypherpunks, coderpunks, or other crypto related > areas, you should recognise what he uses. AFAIK the "fractal cypher" is just a couple of clever technobabble words thrown together for effect. > I have not seen seen it; I am guessing that maybe > they are using something to excite the juices of > us Internet folks. If they are, they're not doing a good job. :) > Mark dave - ----- David E. Smith, P O Box 324, Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail with subject of "send pgp-key" for my PGP public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMp53b3EZTZHwCEpFAQHZQQf9HCh0nR44oSTGZDYCeElkqUfSUX759F2M WoUCuJ10EGO6L1euUiwpyg1eBcgicscOliwf0KNYMSdwj2hfAp/gXhWUR8o0XydU NvnCrOSu2iTvvkzZixB4uuIhKUB8z5Rfzv2Sz0EHWK2XKcBvRhht96uKR7mi+wIg QSfBgdx+RVFIVbFCIA6PWJ3NhRU6p/c+5ptm0fVAJOJJ4uHWswP58l3aimI6Ormu TrxEgFs+BezsqvJLNw3ZcAWCYSkOUKJiCC//w/e210RBEJKZOgiht7sSUTJqQDsx 6Z7mnU0hPfOE2Eco+b0zL4U/B7xskUX22OCuDlcsgLsoK1kggsZgjw== =ciV0 -----END PGP SIGNATURE-----

1 0

Re: Is /dev/random good enough to generate one-time pads?
by Steve Reid 17 Dec '03

17 Dec '03

> > Subj sez it all. > Yes, as a matter of fact it is. /dev/random is based on an entropy pool > taken from hardware interrupts and such, thus is a RNG, not a PRNG I expect it would be "good enough", but it is not _perfectly_ random, and so it wouldn't be a true one-time pad. Because it uses MD5, the bits are not all provably independent. You get (very strong) cryptographic security instead of perfect security. The one-time pad is easy to explain in theory, but implementing it perfectly is extremely difficult. Many people believe that quantum events are the only source of perfect randomness, but most methods for harvesting that randomness could introduce statistical properties. For example, a radioactive substance may have exactly a 50% chance of emitting a particle given a certain amount of time, but what happens if your timer isn't perfect? One-way hashes are good at removing such obvious and not-so-obvious statistical properties, but like a PRNG, you can't prove that the bits it produces are all completely independent. It's definately "good enough", but it's not perfect.

2 1

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Igor Chudov @ home wrote: > > Dale Thorn wrote: > > > The biggest influence on IQ are the so-called "engrams" (fears, super- > > > stitions, anxieties, etc.) planted in your brain early in life. > > > Some of this can be overcome with mental exercise, and awareness of what > > > negative influences are holding you back. Much easier said than done! > > > IQ as they attempt to measure it can probably be most easily explained > > > as pattern matching skills. Unfortunately for testing, and although you > > > can be every bit as intelligent at 70 as at 10, your pattern-matching > > > skills change and evolve over time, so any given tests will only apply > > > (more or less) at the age group they are optimized for. > > > Would you dismiss strong correlations between IQ and success in life > > and academia as something irrelevant? > > Not at all, and I think you could make some interesting equations out of > this if you wanted to spend the time. > > Factors for raw intelligence, i.e., pattern matching skills. > Factors for aggressiveness, assertiveness, self-confidence, etc. > Factors for manipulative ability (to manipulate people, etc.). I don't > know how to properly categorize this last item, but perhaps a professional > psychologist would. > > In sum, I think you could observe successful people and establish most > of the relevant factors, but be aware - if you are not an insider in > several of these "success circles", you might miss one or more key > factors, particularly those that would be denied by successful people, > such as willingness to do things people don't like to talk about openly. Another new error message! Seems like a new one every couple days now.

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

On Thu, 28 Nov 1996 jbugden(a)smtplink.alis.ca wrote: > Another anecdotal example is in the opening chapters of "Surely You're Joking, > Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon > vivant. He describes how his mother introduced a doctor, a general and a > professor with the same respectful tones indicating to him that a career in > academia was as highly valued as any other high position in society. Your lower middle class slip is showing.

1 0

RE: Your Freudian slip is showing
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Bovine Remailer <haystack(a)cow.net> wrote: >On Thu, 28 Nov 1996 jbugden(a)smtplink.alis.ca wrote: > >> Another anecdotal example is in the opening chapters of "Surely You're Joking, >> Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon >> vivant. He describes how his mother introduced a doctor, a general and a >> professor with the same respectful tones indicating to him that a career in >> academia was as highly valued as any other high position in society. > >Your lower middle class slip is showing. Damn right! Everything I have I earned myself. I'm not some pampered child of rich parents. My God, when I think of what my father went through when he was growing up and what he endured to feed our family, I'm amazed that he didn't drop dead in his tracks. The fact that my granfather was a well respected municipal politician didn't insulate them from the effects of the depression. When my father was young he had to walk almost four miles to and from school, and it was uphill both ways. Then when he got home he had to chop wood with a hammer. Of course he could have used an axe, but it was usually dark by this time - they couldn't afford lights - and he found that a miss with the hammer was less likely to cause severe leg trauma. After getting his hand crushed in a printing press as a young man and later, after being layed off after 26 years of hard toil and loyal effort, he wasn't bitter when he was forced to retired on a pension of $650 per year. He was proud to have worked hard all his life and succeeded in his own small but not completely insignificant way. Look where I'm pointing, not at what I'm pointing with. James

1 0

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Dr.Dimitri Vulis KOTM wrote: > > Ernest Hua <hua(a)chromatic.com> writes: > > > McNeil & Lehear (sp?) (ok, I know, one of them is gone, but I forgot > > > which) News Hour had a segment on crypto policy. Generally a balanced > > > non-technical report, except that there is no mention of the free > > > speech issue. > > Do you think they should have mentioned that cypherpunks are against free > > speech and that John Gilmore (spit) is a liar and a content-based censor? > > Gilmore is irrelevant and not worth mentioning. > BTW, there's an excellent picture in the Public Domain showing Robert > McNeil (sp?) looking over the fence on the grassy knoll, seconds after > they blew off the president's head. I guess ol' Bob musta been one of > those "extremely few, ignorant, stupid people" who thought shots may > have come from somewhere besides the depository (per O.C. Register). Another new error message! Seems like every other day now.

1 0

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Ernest Hua wrote: > > > > It is truly counter-productive to insist on conspiracy theories and > > > > anti-government rhetoric. Sure, there have been conspiracies in the > > > > past. Sure, there have been more than our fair share of atrocities. > > [mucho snippo] > > The danger in conspiracy theories (and you can check the L.A. Times for > verification of this) is that they are often tied in to anti-Semitism > and other forms of racism, and/or provide an excuse to.... > > The fact is, though, that only government possesses the power to ruin the > lives of masses of people, which they have often done, even in this century. > Anyone who says "the conspiracies aren't true" and "anti-government rhetoric > is automatically bad", etc. is just sticking their head in the sand. > > The militias are a necessary correction to government excess, however > negative the implications of militia power might be. > > As far as the difficulty in creating the infrastructure to monitor every- > one, well, it exists and is growing by the minute. All "they" have to do > is listen in, and have smart programs to sort out what they want to look > at (which they certainly do). Think of it as a percentage deal. The > people the govt. most want to monitor are the ones who are the most > active in their travel and communication, therefore, it greatly reduces > the monitoring load. Another new error message. Every other day, a new error. Who's doing this?

1 0

Re: market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

At 12:12 PM 11/26/96 +0000, Matthew J. Miszewski wrote: >> 2. Users of programs like PGP today already get at least a fairly decent >> RNG already. Would they want better? (I'm not suggesting a total >> replacement; I assume that the output of any hardware RNG would be hashed >> with more "traditional" PC sources, like disk timings, keyboard timings, >> etc, which should deter attempts to attack just the hardware part.) > >Why would you hash good RNG output? Re-read (read?) Applied Cryptography. Hardware RNG's contain biases, even though they may only be tiny ones. For example, a RNG based on radioactive decay and a geiger counter has a certain minimum "dead time" between decays that introduces a slight bias. Most electronic circuits naively intended to generate random numbers contain similar biases. If I build a device to generate ones and zeroes based on electronic noise, I must assume that there there will be some non-randomness in the output, however small. This is somewhat equivalent to saying that there is somewhat less than 1.000000 bit of entropy in each bit of the RNG output. If I recall correctly, a data stream with 0.5 bits of entropy per bit might be one that contains uncorrelated bits which are "0" 3/4s of the time, "1" 1/4 of the time. Fortunately, as I recall it is possible to, in effect, "distill" the randomness of the sample using hashing. Start out with 200 bits with 0.5 bits per bit of entropy, and you can produce 100 bits with 1.0000 bit per bit of entropy. (Condensing the thing even further can't put more than 1 bit of entropy into each bit; but what it does do is provide some margin for entropy sources whose biases may vary somewhat.) The advantage, however, is that it is probably far easier to distinguish 0.2 bits per bit of entropy from 0.1 bits, compared with distinguishing 0.99 bits from 1.000 bits. If you know you have at least 0.2 bits per bit, hashing down a factor of 10 would produce a solidly random output. If I understand the process correctly, this means that the "figure of merit" of any RNG should be the number of bits of randomized output it can successfully create per second. 100,000 bits per second of output with 0.5 bits of entropy per bit is, therefore, better than 10,000 bits with 1.000 bits per bit, because the former can be converted to 50,000 bits of unbiased output per second. This result may not be exactly counter-intuitive, but it is at least NON-intuitive. But what this does do is to provide an opportunity: Build a circuit that generates reasonably random output at 10x rate, hash it down to 1x, and you can be reasonably certain that the result is cryptographically random. The software could monitor the input to ensure that it remains substantially better than needed to guarantee random output. >I understand your desire to >deter hardware only attacks. I just think it might be an >overreaction. Of course mine could be an under-reaction 8-) I think if the hardware RNG could be corrupted and that would compromise the security appreciably, it WOULD be compromised in important-enough situations. However, adding hashing with more "traditional" sources of randomness would make the job futile. Corrupting the hardware RNG device would merely make the system fall back to the current level of security. >> 3. Even hardware RNG's aren't "perfect": they could be subverted, >> replaced, or perhaps influenced. Would someone who was sufficiently >> sophisticated as to recognize the need for it actually accept a real, >> functioning device? > >It would have to go through rigorous testing in the crypto community. > RNGs v. PRNGs goes through a yearly debate here on cpunks. There >have been some good discussions on the use of white noise and other >potential hardware sources. Im not sure if hks is back up or not, >but you might look there. Well, we have a chicken-and-egg problem. Until a commonly-used program (like PGP, maybe) easily gives the public the option to include a hardware RNG as part of its sources of randomness, few people will be inclined to implement such devices and they will remain atrociously expensive...so nobody will buy them. >If an independant entity could certify the product with a good >reputation for dedication to the community, you would get much >milage. PGP, Inc. might be interested for instance. I mean I have >used PGP for years but have not had the time to go through the code, >etc. I trust it because Phil's reputation precedes him. Well, with all due respect, if Phil hesitates to install a hardware random source link into a piece of software simply because he thinks that to do so puts his reputation on the line, he's placing a high hurdle in front of the development of good, economical hardware randomizers. There's plenty that software can do to protect itself from a compromised hardware RNG; monitoring the biases of the input and hashing it more than adequately is a good start. It should be possible to ensure that a hardware RNG can only improve security, not reduce it. Jim Bell jimbell(a)pacifier.com

1 0

Buy your COMPUTER parts direct from any wholesaler!
by daniel＠earthstar.com 17 Dec '03

17 Dec '03

BUY QUALITY COMPUTERS AND COMPUTER PARTS DIRT CHEAP!!! YOU'RE THROWING YOUR HARD-EARNED MONEY AWAY, if you're not buying your computer parts direct from wholesalers, using my method. Stop relying on unethical computer salesmen to sell you your computer and all its ancillary parts. Why pay full retail. With my method, you can not only PAY WHOLESALE PRICES, but your purchases will be TAX FREE, coming from out of state! You could be buying computer parts for your friends, neighbors, family, coworkers, employers and anyone else. You choose if you add a profit for yourself or not. I was the purchasing agent for over six years with a multimillion dollar computer company. I've been in the business for myself for the last four years. Believe me, I know what I'm talking about. And I'm willing to share my secrets, along with a list of hundreds of contacts in the wholesale computer business for just $4.95. If you still need convincing, E-Mail me at daniel(a)earthstar.com. If you're already convinced that my nominal fee is well worth the fantastic savings you can begin enjoying on your computer parts, send $5.00 to Daniel Decker,11904 Blueway Ave. , OKC, OK 73162 Be sure and include your e-mail address I will immediately e-mail you my secret, oh-so-easy method to getting wholesale costs, tax free, and the list of wholesale computer companies. The list includes the contact names and phone numbers that will help you find any part you need, from RAM chips to CD ROM burners. I'm so confident that this information will pay for itself many times over, I'll refund the COMPLETE purchase price if your not 100 percent satisfied. No questions asked, no hard feelings, period. WHAT ARE YOU WAITING FOR? The longer you wait, the more money you could be wasting. Contact me immediately. I'm ready to help you save money. Daniel Decker daniel(a)earthstar.com

1 0

Re: [ANNOUNCEMENT] Enigma
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Tim C[reep] May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. _ {~} ( V-) Tim C[reep] May '|Y|' _|||_

1 0

Re: wealth and property rights
by Murray Hayes 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996 15:00:36 -0800 (PST), Dave Kinchlea wrote: >On Wed, 27 Nov 1996, snow wrote: >You are clearly an angry young man. I am sorry you have such a poor >opinion of people, I am even more sorry if it is justified. You can >believe me or not, but what you describe is *not* the ordinary case in >this country. Of course, in this country we have a disgusting 10+% >unemployment rate. Even if people DO want to work, there are no jobs. > >All that aside, I can tell you do not have a family if you thing that >$6.50/hr is a living! Even accounting for the difference in our dollar, >I would say that is barely subsistence income for a single person. Are >we *all* not worthy of more than that? > Yes, there are maany angry young men in this country. Unions prevent young men from compeating in the market place. Unemployment Insurance artificialy increases the unemployment rate by 2% (this is a figure that many people more knowledgable than me have stated) welfare increases the unemployment rate by another 1%. The Canadian Pension Plan is out of money and yet I am still forced to contribute and for what??? Will it still exist when I retire? Not bloody likely. Fortunatly NAFTA has forced some of our companies to compeat or die. Take a look at Canadian. Are they gone? I didn't get to watch the news today...... I'll bet that most of the employees would gladly take a 10% wage cut to save to company but the union leaders won't let them vote on it. Why? Because they would loose power. Look at what the govn't do. Most of them just contribute to the problem by offering hand outs. They don't need hand outs! ONE gov't (Alberta) offered to lower the fuel taxes. YAAAAA RALPH!!! (Who's ecinomic reforms incidentally (sp) was hearalded by the Post as a model for govn't across North America) Cut taxes and kill the union leaders. Sorry for siting my sources..... mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

2 1

Re[2]: Sound card as a random number source ??
by Pavel Korensky 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk wrote: > > I`m not entirely sure about the possibility of correlations in any of > these sources but they aren`t really a good idea because all can be > accessed by someone else. eg. Steal your random noise audio tape, > sample dolby decoded sound at the same time as you etc. And what if I will use FM receiver, tuned on some channel where is the noise. If the potentional attacker don't know the what channel was tuned, he is not able to reproduce this IMHO. Of course, maybe it is possible to record the whole spectrum to tapes, but I think that the noise will change when recorded and played back from tape. Bye PavelK -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

1 0

Re: Whitehouse Releases Blueprint...
by Will Rodger 17 Dec '03

17 Dec '03

At 04:08 AM 11/29/96 +0000, you wrote: > > Notably, the emphasis is on the needs of business, not "people." > > We are in an excellent position to observe and document the process whereby > "business" -- that is, organizations motivated primarily, if not exclusively, > by the desire for short-term profits accruing to vested interests -- comes > to dominate and control a technology. The auto and television industries come > to mind as two prior examples. We are about to see the net go the same way. > Take notes. > > "I have to praise the administration and Ira for > reaching out to the private sector for > comments," Computers and Communication > Industry Association President Ed Black said. > "There's a great emphasis on the needs of > business here." > > Even so, privacy activists remained > disappointed with many of the document's > features. "This isn't anything new," said David > Banisar, counsel to the Electronic Privacy and > Information Center. "The privacy stuff is > terrible. They say it's market driven, but > markets don't work with privacy. It's like what > happened with P-Trak." > You bring up a point that is implied - but not explicit - in the article. And it's a good one. Funny thing is, two of the _industry_ folks suggested individuals probably needed to be included in the document more than they were. Neither was keen on being quoted on the record regarding non-business interests, of course. Given the attitude of the folks I talked to, I suspect non-business interests are still fairly important to the White House on this one. And remember: Ira Magaziner won no friends in industry with his health care proposals a couple of years back; some folks think he's leaning in favor of industry at least initially to make sure what happened then doesn't happen again. If Netizens find suggestions from the administration too heavy-handed, my guess is there's still time to move the discussion. Cheers. Will Rodger Washington Bureau Chief Inter@ctive Week

1 0

cgi-bin vulnerability
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

does anyone have a pointer to any sample scripts for exploiting the cgi-bin/phf vulnerability? cheers, -paul

3 2

Re: Counterproductive Dorothy Denning Flames
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> So, they feel compelled to harrass anyone who's smarter / more > knowledgeable than they are (sometimes using the anonymous remailers) in > an effort to drive all intelligent discussion off their "private mailing > list", so ignoramuses like Bradley can sound like "local experts". I think you might be missing the very succinct and subtle point that all you ever contributed to this list (despite your knowledge of cryptography) was rants about sovok jews and Tim Mays sexual orientation. I happen to be knowledgable about cryptography but even if I`m not an expert I do tend to post things that are of value and interest as opposed to worthless flames. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

First Contact
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, Is there anything in First Contact to do with Crypto at all? Just that it opened out here today, and I'm going to see it. Yours Sincerely, Benjamin Grosman ------------------------------------------------------------- bgrosman(a)healey.com.au -- http://www.healey.com.au/~bgrosman/ PGP Encrypted Mail Preferred -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzKNX9oAAAEEAOIx4HkRU4vckgguzERhVCxgy5psmngHUoW10Xl8kBkjnuc/ ACysH1K98UXlGfet9zjn/XN4RMnGq64EHXvJu56H7OHhwhoerTpVIW5MUYt+QExk KKnRNrdq8WVGoaMywSM4qKbaJr8aNMBWkldUKR4NElvAjIEEO9z0msNPp33RAAUR tClCZW5qYW1pbiBHcm9zbWFuIDxiZ3Jvc21hbkBoZWFsZXkuY29tLmF1PokAlQMF EDKNX9vc9JrDT6d90QEBxVYEAL5nw1NiyaPpG8R2x7lNcqOcavj/cCmDYT8swT02 Z0AO0C7PGpgp9V38Yyki0FB3yaiJhIQ3Kw6xCtuI8f1F4Vfql/nZebzQERl8kTa4 sI/4xSKRT/Riw/wSGupagU1F1wYIPlXOCdUilIfLzVf4IOsxKjJMdm7aKladSxkV N7Yg =Yapx -----END PGP PUBLIC KEY BLOCK-----

3 2

The House Rules At The Permanent Virtual Cypherpunks Party
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is a document I just hacked. I am breaking several of the Rules by posting it, since I am not actually subscribed to cypherpunks right now. Enjoy. Bryce - ------- 0. Hello Welcome to the cypherpunks mailing list! Starting now, you will receive hundreds of email letters every week on the subject of privacy and social change in an age of cryptographic networks. PLEASE, for everyone's sake, SAVE THIS MESSAGE! If you ever want to remove yourself from this mailing list, you can send mail to <majordomo(a)toad.com> (NOT <cypherpunks(a)toad.com>) with the following command (correctly spelled) in the body of your e-mail message: unsubscribe cypherpunks Their Name <them(a)theiraddress.xxx> Here's the general information for the list you've subscribed to, in case you don't already have it: I. Etiquette -- The House Rules At The Virtual Cypherpunks Party The Meta-Rule: It's John Gilmore's virtual house. He is the sole owner of the computer (toad.com) that hosts cypherpunks and the sole authority over what the users of that computer (you) can do with it. Rule 1: Do not _ever_ send email to the list <cypherpunks(a)toad.com> asking how to accomplish some administrative task like unsubscribing yourself. If you do, you will be roundly flamed, and nobody will answer your question. Instead, send email to <majordomo(a)toad.com>, or read the "Administrivia" section below. Rule 2: Don't forward articles from other forums to cypherpunks. We can find it ourselves the same place you did if we want to read it. If you have something useful to say about the article, then consider writing a review of the article or a response to it and posting _your_ article along with a pointer to the original article. Rule 3: Don't cross-post articles to cypherpunks as well as to other lists. Rule 4: Read before you post. If you are new, don't post at _all_ until you have read a few weeks of discussion. Rule 5: When replying to a message, ask yourself if more than a thousand other subscribers really need to see your response, or if is more appropriate to reply privately. Rule 6: Don't ask questions which are already answered in the resources described below. How can you know whether your question is already answered in those resources? Simple: read them. Rule 7: Don't publically reply to someone just to flame him/her because it makes you feel better. We are not here to make you feel better; we are here to read quality discussion about certain issues. Some people actually _specialize_ in tempting their adversaries into publically flaming them. Don't be a stooge by falling for it. Advice: The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQs referenced below. These documents are a good introduction. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. We've noticed that people who post a lot usually have less to say. Refrain from contributing too much. Re-read your article before your send it. Then re-read it again. I'm serious-- go back over it _twice_. Really. It helps. Assume any message from you to the list, no matter how insignificant or casual, is archived somewhere for eternity for future employers and acquaintances to read (it probably is). You may even wish to unsubscribe right now and then re-subscribe under a "nym," rather than using your true name, if your views are especially controversial or your job prospects are sensitive. II. Administrivia -- How To Unsubscribe And Stuff If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net (Is Eric still doing this?) This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The majordomo address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. [There is no digest version available.] (We should put in info here about subscribing to Alan's digest at gateway.com and the 2(?) filtered versions of the list here. Does someone have all that?) There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. III. About Other Forums There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as it says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. If you are beginning to use PGP and have questions, you can also subscribe to the PGPusers list by sending mail to pgp-users-request(a)rivertown.net with a subject of subscribe, or as an alternative way to subscribe use their Web Mailing List Gateway at http://pgp.rivertown.net/#Subscribe IV. About Net.Loons On cypherpunks The cypherpunks list has attracted a fair number of net.loons in its day. If you see an inflammatory article that seems too crazy to be serious, then it probably is. The hallmark of these loons is rudeness, and the preferred policy in just to ignore their postings (tempting as it is to respond). Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. V. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. D. For a more technical, lower volume, and much less policy-politics oriented list, you might try to subscribe to the coderpunks list, which branched off of cypherpunks some time ago, due to frustration with loons. It also runs at toad, and you can be considered for subscription by sending mail to Majordomo(a)toad.com with these words in the body of the message: subscribe coderpunks Their Name <them(a)theiraddress.xxx> E. The Snake Oil FAQ, by Matt Curtin & others, located at: http://www.research.megasoft.com/people/cmcurtin/snake-oil-faq.html Has some useful warning signs to keep in mind. "Snake Oil," here, means "weak cryptography," which brings us to... F. An incomplete cypherpunks translation list: PGP -- Pretty Good Privacy software. PRZ -- Philip R. Zimmermann, PGP's author. GAK -- Government Access to Keys (for crypto, but it might as well be for your front door). KRAP -- Key Recovery Access Program (a brand new flavor of GAK). TLAs -- Three Letter Agencies (the alphabet soup of the US government -- FBI, DEA, IRS, CIA, DIA, NRO, ATF, NSA -- all your favorites). NSA -- the US National Security Agency in Fort Meade, Maryland, responsible for encryption codes and computer security for the entire US government. LEAs -- Law Enforcement Agencies (see above, at least when they're not busy breaking the law themselves...). ITAR -- International Traffic in Arms Regulations. A silly US government regulation outlawing the "export" of strong cryptography software which is all over the planet anyway. [Please suggest other resources and acronyms.] IV. Famous last words My preferred e-mail address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric [From here on I changed/added nothing (it's gospel, after all:). -- JMR] - ---------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated 11/28/95] -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMp2nikjbHy8sKZitAQGoiQMAgAfvKA0751PAW6ivMQ0+KQfa19cuueFY VqPWxJSMXBE+8v37+sx6nn7FN/qFYkoccaBkOJdOZb7zu2kX+ptV/T153F6cFFFT 6RULRhMKQOiWB7JV+fdr2QV136hR8U/1 =AKDO -----END PGP SIGNATURE-----

9 23

Counterproductive Dorothy Denning Flames
by mpd＠netcom.com 17 Dec '03

17 Dec '03

William H. Geiger III writes: > Dorthy Denning is a boot-licking fasicist!!! > William Reinsch is a lying bastard. Fucking politions!! > Fucking goverment!! They all deserve a long rope!! It is perhaps a point in Dr. Denning's favor that her most vitriolic detractors can spell neither "Dorothy" nor "fascist". I must admit that I am at a loss to understand the heat which Dorothy Denning generates on the Cypherpunks list, which seems to be second only to the heat generated by posting recipes for roast feline in rec.pets.cats. All of the people I know who have met her find her to be a pleasant person, and the occasional Email messages we have exchanged have certainly been positive and friendly. While she tends to view the Four Horsemen of the Infocolypse as a bit more threatening than the typical Cypherpunk, I don't think her views are so extreme as to justify the continuous screams of "crypto toady", "government suckup", and "wicked witch" which seem to pop up in response to her every utterance. I would even go so far as to say that this list would be a lot more entertaining if she were contributing to it, and sci.crypt is certainly a less interesting place now than it was in bygone days when she was posting there. Perhaps Tim can add his own thoughts to this thread. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 10

Re: market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

At 06:08 AM 11/26/96 -0800, Paul Pomes wrote: >There are some commercial products worth studying. See ><http://rainbow.rmi.net/~comscire/> for one. Thanks for the reference. However, I was very unimpressed with their price of $295 dollars. I don't doubt that there are certain organizations (banks?) which would have no problem affording them, but that's well out of the range of ordinary consumer items. I just bought a 10x CDROM drive for $100; somehow I think that a hardware RNG should cost less than that. Volume is a big issue, I suppose. Jim Bell jimbell(a)pacifier.com

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by null＠void.gov 17 Dec '03

17 Dec '03

I would say that depends on -where- &/or -how- you store the premaster/master, and is dependent on platform threat models rather than attacks on the wire. These are different problem spaces with different solutions, which some contemplated changes to SSL may help address: some tweaks may be useful to support more secure secret management on the platforms. But I would not go so far as to say that these issues make SSL or an implementation insecure per-se, until I did the complete job. If my platform is compromised such that the master or premaster secret can be subverted, then I have problems that go way deeper than SSL or a particular implementation of it. Would you like to propose some fixes? We would be very interested. Ben Laurie wrote .... >SSL requires the keying material to be available at all times. This is rather >different from many applications of cryptography, where one can keep keying >material safely locked away except when it is needed. > >This is the inherent vulnerability. > >Cheers, > >Ben. > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

1 0

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by null＠void.gov 17 Dec '03

17 Dec '03

Well, then, tanslation: "I say SSLEAY is not secure - but to actually do the homework to back my assertion then someone has to pay me." Hmmmph. Not very useful. Nor credible. >I think I would discuss this with the author before going public, to give >him the usual opportunity to clean up before all hell breaks loose. However, >that is what I'd call "work" rather than "fun", so I'd want paying for it. > >No doubt I'll take it up with Eric at some point, when neither of us has >anything better to do. > >My impression is that Eric is more interested in speed and functionality than >strict security (and considering the incredible vulnerability that is more or >less inherent in an SSL implementation, I feel the same). I could be wrong, of >course. > >I will say that I'm not aware of any problems that a good firewall and physical >security don't take care of. That isn't to say there aren't any - I haven't >looked that hard. > >Cheers, > >Ben. > >> >> >I've never seen a security review of SSLeay, and if anyone gave it a clean >> bill >> >of health, they didn't have their eye on the ball. Note, I'm not knocking >> >SSLeay here, it is a wonderful lump of code, but it hasn't been written with >> >security in mind (IMHO). >> > >> >Cheers, >> > >> >Ben. >> > >> >-- >> >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >> >Freelance Consultant and Fax: +44 (181) 994 6472 >> >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >> >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >> >London, England. Apache-SSL author >> > >> > > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

News Release (USCIB): Tuesday, November 26, 1996 Banks Making Sweeping Changes in Operations to Meet Challenges of International Markets Study finds international banks applying mix of reengineering and new technology to improve operations. In an effort to reduce costs and boost productivity, international banks are reengineering their operations departments and updating technology at increased rates, according to a two-year study of top international banking operations officers conducted by the U.S. Council on International Banking (USCIB) and the USCIB Foundation. Operations departments, which generally maintain activity other than retail banking or customer service, are becoming increasingly critical in international banking, due to the explosive growth of transnational business and the convergence of commercial and investment bank activities. Such industry developments have left many corporate clients looking for "one-stop shopping" for their banking matters as an easier way to meet their financing needs. At the USCIB Annual Conference in mid-November, it was noted that banks are going to have to employ more agility in order to satisfy their corporate clients' escalating demands for simplicity. The increasing cost of running an operations department is also forcing executives to take a sharper look at where they can trim their budgets. According to the USCIB study the annual operations department budget is now $ 15 million, compared with $ 9 million in 1995, an increase of more than sixty-six (66%) percent. In more than half (52%) of the operations departments surveyed, labor costs accounted for fifty (50%) percent or more of their budgets. To reduce costs, executives have turned to reengineering and downsizing. Thirty six (36%) percent have reengineered their departments, and of those, sixty-three (63%) percent reported the action had reduced costs and improved productivity. Nearly one-half (49%) of operations executives have either downsized their departments in the past year or plan to in the one to come. In addition, all of the executives surveyed plan to invest in technology over the next 12 months in order to speed up operations and handle the increase in international transaction banking. Ninety-six (96%) percent of respondents say they will invest in technology, up from eighty-nine (89%) percent in 1995. Just under half of surveyed operations departments use a technology system that is over three years old, and sixty-three (63%) percent of prospective buyers expect to spend more than $100,000 to replace or upgrade aging equipment in the next year. The U.S. Council on International Banking (USCIB) is a national association representing more than 320 U.S. and foreign-based financial institutions with operations or subsidiaries in the United States. One of the oldest U.S. banking associations, the USCIB works to standardize international banking rules and practices, serves as advocate to U.S. and international regulatory bodies on policy issues that affect its membership, and provides training and information to bankers throughout the United States. This study included 55 of its members and other executives and was conducted in late July and August, 1996.

1 0

Re: cgi-bin vulnerability
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

i think that i understand what you are trying to say, however, my purpose in asking for this information has nothing to do with what i know. i am pulling together a series of tests for our firewall, and am not satisfied that the entries/cracks that i know are the only ones that exist, therefore, i ask others for their input. seems reasonable, doesn't it? thanks for you response. cheers, -paul > From deviant(a)pooh-corner.com Fri Nov 29 12:55:52 1996 > Date: Fri, 29 Nov 1996 17:54:10 +0000 (GMT) > From: The Deviant <deviant(a)pooh-corner.com> > X-Sender: deviant(a)random.sp.org > To: pjb(a)ny.ubs.com > cc: cypherpunks(a)toad.com > Subject: Re: cgi-bin vulnerability > Organization: The Silicon Pirates > MIME-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Content-Length: 1025 > > -----BEGIN PGP SIGNED MESSAGE----- > > On Fri, 29 Nov 1996 pjb(a)ny.ubs.com wrote: > > > does anyone have a pointer to any sample scripts for exploiting the cgi-bin/phf > > vulnerability? > > > > cheers, > > -paul > > > > If you can't figure out how, you probably don't need to know. (actually, > its so simple the average high school student could probablyfigure it out, > if they knew what %0A meant... oops.. wasn't supposed to tell you that... > ;) > > --Deviant > PGP KeyID = E820F015 Fingerprint = 3D6AAB628E3DFAA9 F7D35736ABC56D39 > > "All in all is all we are." > -- Kurt Cobain > > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQEVAwUBMp8jSjCdEh3oIPAVAQFkoAf+Nu62ObHyWHgDvkWAqqH7QTw4svfkELTB > d5E8S1ghkyxL1219LwGljelQ+uHaZt4EGB/nnDfQo7H2J9fMDR1CLJRC+h95xxKM > mKuAVbVT1W3nPm4+WP5DIplMvF/xVmextdbGLmAfYQksXQ4uGNRuaawS9G2ffYLP > erBEN9XuxvVY0AnTYCErnpDdOhh4BNTi2+os86Ea+mXt2FG3D8y0pdfRSnOJm2YU > yvQ7pUrMfhl9DGauc+lvb42B8OXWElnjYIFloxWr+rxACzS6NCbGF3izjfTv+2HX > tRZUuwYNee3j+p7kDY9ebANJqWUcMtR9To5za1/vlA4QAtPl5HsaVw== > =3/ok > -----END PGP SIGNATURE----- > >

1 0

SSLeay security
by Ben Laurie 17 Dec '03

17 Dec '03

It seems I have expressed myself poorly. My point was that, as far as I am aware, SSLeay has not been widely reviewed. A lot of people use it, sure, but that is not review. Since there are obvious defects in the code, from a security point of view, such as failure to scrub keys, it wouldn't get a clean bill of health from me. Of course, these kinds of defects require other defects in the user's security policy (such as running on an operating system which permits free access to memory) to exploit. There may or may not be worse problems. I don't know. And I won't know until either it becomes important to me, someone pays me to find out, or someone else points them out. I'm not saying that I'm aware of defects which are not obvious but my experience in using it suggests that it may have them - it isn't that hard to crash, and where there are crashes lurk possible security holes. Tracking these down is where it stops being fun. At least for me. Cheers, Ben. -- Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk Freelance Consultant and Fax: +44 (181) 994 6472 Technical Director URL: http://www.algroup.co.uk/Apache-SSL A.L. Digital Ltd, Apache Group member (http://www.apache.org) London, England. Apache-SSL author

1 0

Seditious Cable!
by nobody＠replay.com 17 Dec '03

17 Dec '03

dlv(a)bwalk.dm.com wrote to All: d> Doug Barnes <cman(a)c2.net> writes: >> (Taiwan story warning...) This reminds me of the pirate cable >> TV wars, which hit their peak during my stay there -- [...] d> Now, what would the U.S. government (state or los federales) do in a d> similar situation? They'd probably fine any resident found with a d> cable TV thousands of dollars and if that didn't work, they'd start d> jailing people. Maybe even burn a few TV viewers, a la Waco. :-) And these are the folks you want to maintain your key escrow?

3 4

denial of service and government rights
by attila＠primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- read the last line. the usual rules of evidence which give the feds the right to anything they well please --constitutional or not! if seizure of a victims property can by obtained a search and sieze warrant for the victimized "object," a whole new mode of regulation has begun. all the government will do to suppress sites as they please, is to initiate a few attacks themselves --and they will. I got tired of paying Lexus $150 for idle months after dumping West for almost $500/month --otherwise I would run down the Feds kangaroo ruling which seems to grant them this absurd right. Several on the list are still maintaining accounts... ? ====== begin forwarded text ====== Computer Attacks Show New Patterns The major trends in computer break-ins involve denial of service and data-driven attacks, says a Department of Justice lawyer. Denial of service occurs when an attacker "bombs" an Internet service provider with so many e-mail messages that the server becomes overloaded and shuts down. Data-driven attacks occur when a virus program is disguised as a data-only file. The file can be hidden in a Java program on a Web page, and when a visitor clicks on the site, he or she unwittingly downloads the virus. A computer crime consultant with SAIC warns that these attacks can be launched on an innocent party's Web server, but once that happens, the server can become the subject of a wiretap and a search warrant. "The title of your computer vests with the government as soon as a hacker uses it to commit a crime," he says. [BNA Daily Report for Executives 25 Nov 96 A20] ====== end forwarded text ====== - -- "In nature, stupidity gets you killed. In the workplace, it gets you promoted. In politics, it gets you re-elected." --attila -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: Encrypted with 2.6.3i. Requires 2.6 or later. iQCVAwUBMp83lr04kQrCC2kFAQFYuAP/bLbraU6rFFLQZpFfsvxiGrbm7W26p3t9 GffgoN/LA6OBqIEUpAdPxGoVqco7RDpHHprhObEV4MorR3BsK6pl5EVNbc3Xp7OC pxFThx0O08bscdmVBSYAUsU2hXMuW2AiuAkxBwCRdaG0bxswr97JQI9ye+pjKTPw cARrd7QLmz4= =vUe3 -----END PGP SIGNATURE-----

1 0

Punative Seizure was: Re: denial of service and ...
by Tim Scanlon 17 Dec '03

17 Dec '03

Tired.Fighter(a)dhp.com wrote: > > > This thread is probably already due for a change in > the Subject line, but I'll leave it untouched for > the moment. I changed it, because I'm very familiar with what's being discussed. I also snipped huge chunks, but tried to leave the salient stuff. > On 30 Nov 96 at 13:10, Black Unicorn wrote: > > On Fri, 29 Nov 1996, Greg Broiles wrote: > > > > > I don't see any reason why this wouldn't be true for a > > > computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure > > > (but seizure is not forfeiture) of "property that > > > constitutes evidence of the commission of a > > > criminal offense". > [....] > > Recall also that Ripco was never specifically charged > > (or the minor charges that they did try to pin didn't > > stick). > > Also recall that Ripco (now ripco.com) was raided with a > > -sealed- warrant. I dont think that the contents of that > > warrant have, even today, been released (though I could > > be mistaken). Certainly 5 years after they had not. > [....] Yes, it was & is sealed, the justification being that the investigation was "ongoing". The whole thig was weak & shameless, but it works for the feds. Never mind that it's total & utter bullshit. > > > But there's a big difference between "seizure" and > > > "forfeiture". Not really. Only technicly. The technique used by LEO's is one that is known as "Punative Seizure", and is well known in the Computer Underground. It's standard practice for LEO's to engage in seizure of computer equipment and just to keep it. Much of the time it is accompanied with an explicit and literal threat of prosecution if the unindited suspect asks for the equipment back. It's cheaper than prosecuting, easier to accomplish, and often achives the goal of "taking the bad guy off the street" without resort to such niceties as having a case that would hold the moisture of a drop of spit. It is such common practice, that most hackers who have been around for even short lengths of time are very familiar with the practice. In cases involving juviniles, it's a very effective technique. In those specific types of incidents the drill is as follows: Suspect "H", a 15 year old male, living at home with his parents, does something to bring him under suspicion that he is involved in computer fraud. Incidents are ongoing and seem to point to the suspect, local or federal agents become interested in the suspect due to information provided by a C.I. So they go fishing, and seize his equipment. Seizure is accompanied in concert with several other actions and goals, One of which is to explore the contents of the computer for further evidence of wrongdoing. Since aquiring search warrents for such actions are notoriously broad and relativly easy to come by, this is an effective technique. The seizure usualy is stratigicly done to minimize parental involvment and possible protections, in order to give investigators time alone with the juvinile suspect to question him without the intervention of his guardians. Basicly they want Mom or Pop out of the picture long enough to pump the kid for info before the parents can insist on legal counsel. Obviously they use whatever info they can get... Keep in mind a poorly socialized, but bright, teenager is likely to be a rather talkative target and an easy mark for interrogatory techniques. "We find they want to talk, and often brag about their exploits" is such a well worn quote, that I'd have to attribute it to about 7 sources if I tried... You can extrapolate on this. The next stage is threats to the parents of the juvinile, usualy big federal time, that sort of thing, to try to terroroize them into insisting on little Johnny's co-operation. Usualy this is done without the advice of counsel if the feds can pull it off. There's a tradition of inflating numbers far beyond anything rational, so the "damages" are insanely high, and markedly fictional to anyone who knows how to cost such stuff out. It's in the favor of everyone involved to 'play ball' on cost inflation, for a multitude of reasons. Again, you can extrapolate why. The E911 case is a great example of fictional cost inflation. At that point they have Johnny under the gun, the parents terrorized, and can either work that for further co-operation, or let the kid dangle for a few years & pretty much make sure he never sees a computer. What can I say, it works for them. Don't expect them to care any, they've accomplished their goals. Quite often, as I have said, they will explicitly say "Don't ask for your stuff back or we'll charge you". (And YES that is a direct quote given to me on more than one occasion by people who've had such encounters.) In the case of adult individuals, the setup is nearly the same, wether it is a consultant running a small buisness, or a college student. The only big differences are threats to reputation, either academicly, or in the community at large. After all, once branded an 'evil hacker' by the police or media, what company would do buisness with such a scoundrel. Never mind wether or not they have a thing to do with computer security, that part's utterly irrelivant. In the case of college students, usualy it's a threat of expusion & prosecution etc. Obviously techniques vary. But one thing is clear, there's plenty of "examples" that have been made to terrorize people. I'm sure you can think of a few, and probably will sit there and go 'yea but he deserved it...' Well, when you think that I suggest very strongly that you rethink it, and consider that perhaps you don't have all, or even any, facts that have not been spun and spoon fed to you. The nuber of such punative seizures that I am aware of runs into the hundreds. > > And it sums to a very bleak picture, indeed. > Bleak? heh, get used to it. Hell, this is so damned common that it's made it into comic books as a normal operative procedure. Look in "The Hacker Files" to find it. It's a comic book put out in 1993 by D.C. Comics, and in the Jan issue, Vol 6, Page 14-15 you can see exactly what I'm referencing. Obviously this is not something new. This is why the guidelines that were procured via FOIA by EPIC are so important. Hell, look at the 2600 pentagon-city case for some real chilling stuff. The Secret Service mounted what amounts to a covert operation against attendee's at a 2600 meeting at a mall in Northern Virginia. In any case, the search guidelines are pretty important, so is the Steve Jackson Games case when it comes to ISP/Web Site providers and the like. As is the ECPA, as it relates to individuals and service providers. There is substantive law on this stuff, you just have to dig a bit to find it. Some of these "high profile examples" didn't work out too damned well cause of organizations like the EFF & later on EPIC and the ACLU. Pardon me if I don't seem alarmed or appropriatly indignant, but I've long since gotten used to getting calls as 4 am from some poor fucking kid who's had his life ripped to shreds because he was doing something relativly innocuous but altogether stupid and disruprive enough to have him attract attention. Much less having similar calls from peoples counsels who have no freaking clue how to proceed in defending their clients. As for this type of activity from LEO's? Get used to it, this is how it's done in America. I'm totaly sure that there's going to soon be some poor freaking ISP out there who's going to be hit with very similar techniques, and in all probability prosecuted to provide an example or 2. They need a few good examples for ISP's really, there arn't enough right now. And, I am equaly sure that there's been some quiet seizures & returns with deals involving "co-operation" of ISP's for warez and the like. I sure as hell have a very hard time beliving that Sameer and everyone else who got hit with him by the SPA and their fucking goons were unique. I suspect they were to be an "example" however, as the SPA has a traditional role of both being stooges & goons for Federal Law Enforcment, and an appropriately one-step-removed publicity outlet. The SPA is much like what "railroad security" was in the 1800's, basicly a private police force that operates allmost outside the law. As to what anyone can do? Well not much, from what I've seen. It's just not trendy to defend individual civil liberties, the EFF tossed in the towel in favor of Telco donations. EPIC is doing a good job with the resources they have, they could use some serious donations, and it would be money well spent. Beyond that you have the ACLU, and that's pretty much it. Too many software and hardware corporations lost any moral compass at the end of the 80's and in the early 90's, and don't consider such things to be a neccesary part of their world. It's hard to compete with guys in black suits who wave the flag allot and mutter about secrecy and such things. They're the same damned bunch that want us all to have GAK too, so don't think you're somehow immune cause you arn't a "hacker". You may soon be a "pirate cryptographer", and find yourself in the company of child pornographers and terrorists. (What? Oh you've noticed you allready ARE?, well, get used to it, it's only gonna get louder. First they came for the hackers, now it's your turn.) Tim

1 0

PGP 2.63ui support for the MAC
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: PGP 2.63ui support for the MAC I have received a few inquiries about support for the Macintosh. Unfortunately, the small team working on PGP 2.63ui does not have the expertise or tools to support the MAC or platforms other than MSDOS. However, since we have published our source code, we welcome participation by people who want to add support for the MAC or other platforms. All we ask is that any changes be controlled by conditional compile statements so that we can maintain a unified source code for all platforms. American friends who are concerned about legal difficulties may contact me via encrypted Email in strictest confidence. Finally, I understand that Stale's MIT-based version of PGP does have a good selection of support for the MAC and various other platforms. We are not going to object strenuously if some of our enhancements, now unique to 2.63ui, find their way into a future release of Stale's version. Steve Crompton 100645.1716(a)compuserve.com (preferred) -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQEVAwUBMp9MIhRHWQsRmI2RAQGD/wgAuuBRclY2ovL7uZ7nukcR9maz85GSCYS7 gbYcToxWhZMA3YMMDmV8260qG9BmF0dHoNt39HfEjcordiTU2gLOTmyWqTIWXyA3 uRuKwZQiGPc2bxf+p62G0KdXEdEPcJ98vZWAxVkZwNDlkTg8FZ+O0NsQOPkBMSCO cE+kiJDk/71CEMwBhu4Q2QN9KBtX+MpcOvT6v1M5vIFAtO31OHaiz/0/tBCitpDP ukNX8Ntmht+/Izmma3lQaiuFo3i6pXH7qPxKBE38ZNU+w/CtiEPoy/uWN69L3l2D 6RIBbtdvbIkE6ZWotuPcsy/TxqJNsDdnztksfP2EpoKCG9vnHoaU3w== =8vJt -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. mQCNAy+FS/kAAAEEAKsKQxcaOw8GQpGXEm4hCfqWyeVlh2Ai9AYvXxPy1VrWYNUu NDafHwhfoAjM1apHT6CcISw9D4NNeJtXWutv8mKQjumsITzGZ/mSRlOLzxTbdOtD qyuXjSWt2TIm+ffttbZLsurP8genv4LFDHxGiVeKaAA64CnI4wc2DukbwCfhAAUR tC1TdGVwaGVuIENyb21wdG9uIDwxMDA2NDUuMTcxNkBjb21wdXNlcnZlLmNvbT6J AJUDBRAw062s3ic1/dqHwMcBATFuA/9HeAnZWL8MVHSx3/Ux5vRKxpAqrKs9llgN 5RmaGX+lBW6GASnSdpyrBXTG7+li/X57Jmgq04X3rWZm34Qdo6D2266aKkXc9PkM njuMpmw29Ejza5VYUlz8jMm5vUDEgaPtA5a4JL9+HLhCPCv298177kFZrZBvUgll 1/PO1bpTaokAlQMFEC/tv3UuGDEtkMU5FQEBxYAD/Rsbr7PlHSOns3WsULqmdU9Z 1vKrlmp/sma950jMRC75tJNE1R0eBcE+1eHWkpDhcQ2rlpVTiEcO3IcOBv4ycAjG ZeVcv7hEmMd+Rf+75L/Y0DAZEB9SjX46TTagEYAURK/qWMl47nZpQiyo2VyM/5Br 3fGzuUH/ZE8gjhdYVTQE =WBzQ -----END PGP PUBLIC KEY BLOCK-----

1 0

A URL for Dimitri
by Slothrop 17 Dec '03

17 Dec '03

http://www.torah.org/learning/halashon/ jd -- Jason Durbin Stop Reading Here<--

1 0

LON_ely
by John Young 17 Dec '03

17 Dec '03

11-25-96: "Intel Enters Encryption Market With HP For PCMCIA Card " So far, HP is the only computer company offering the combination PCMCIA and smart card encryption hardware. VLSI and Tandem are developing an encryption chip for use on a PCMCIA card. VLSI built the infamous Clipper chip developed by the NSA that was shot down as a proposed government standard after overwhelming industry opposition. In a separate development, National Semi, one of two suppliers of the Fortessa encryption card, scaled back its government encryption operations. Program delays, slim margins, and contract disputes with the NSA disillusioned the chip maker. ----- LON_ely (5 kb)

1 0

Announcement: Very Good Privacy
by Mark Rosen 17 Dec '03

17 Dec '03

I have written an encryption program called Very Good Privacy for Windows 95/NT. It supports drag-and-drop encryption using the following algorithms: ASCII (Caesar), BlowFish, DES, IDEA, NewDES, RC4, Safer SK-128, and Vigenere. After the files are encrypted, the user has the option of securely deleting the source files using a stream of random text. Very Good Privacy is shareware with a $5-$10 registration fee. Please note: Pretty Good Privacy is only "pretty good" but Very Good Privacy is "very good." :-) VGP can be downloaded at: http://www.geocities.com/SiliconValley/Pines/2690 If you have any questions, please e-mail vgp(a)cryogen.com

3 4

Programming Errors
by Weissman, Gregg 17 Dec '03

17 Dec '03

______________________________ Forward Header __________________________________ Subject: Programming Errors Author: Alan Arndt <aga(a)intertrust.com> at internet Date: 11/19/96 1:50 PM >From New Scientist, 28 August 93, Feedback column: "The National Westminster Bank admitted last month that it keeps personal information about its customers, such as their political affiliation on computer. But now Computer Weekly reveals that a financial institution, sadly unnamed, has gone one better and moved into the realm of personal abuse. The institution decided to mailshot 2000 of its richest customers, inviting them to buy extra services. One of its computer programmers wrote a program to search through its databases and select its customers automatically. He tested the program with an imaginary customer called Rich Bastard. Unfortunately, an error resulted in all 2000 letters being addressed "Dear Rich Bastard". The luckless programmer was subsequently sacked."

2 1

Re: denial of service and government rights
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I see two general arguments that go in the direction of the SAIC consultant's comments: 1. Seizure & retention as evidence or instrumentality of a crime - e.g., if someone breaks into my house, steals my gun, and uses it to shoot someone, it'll be a long damn time before I get my gun back. The prosecution will likely want to do various forensic tests, the defense may want to do its own, the prosecutor will want to wave it around at trial, it may even go back to the jury room to pass around while they deliberate - and if there's a mistrial/new trial granted, the cycle starts again. (Off of the top of my head, I can't remember what happens to physical evidence after trial but during appeal.) Generally, people who are unfortunate enough to have property which gets sucked into a criminal investigation/trial are just out of luck. Bummer. I don't see any reason why this wouldn't be true for a computer. Fed.Rul.Crim.Pro. 41(b)(1) allows the seizure (but seizure is not forfeiture) of "property that constitutes evidence of the commission of a criminal offense". 2. Forfeiture of the instrumentality of a crime, or of a nuisance - cf. _Bennis v. Michigan_ <http://www.law.cornell.edu/supct/cases/94-8729.html>, the recent Supreme Court case where the "Justices" (cough cough) upheld the forfeiture of a wife's half interest in a car which was used (without her knowledge/consent) by her husband to facilitate the crime of prostitution. The Supreme Court rejected the idea that the Fifth Amendment's takings clause or the Fourteenth Amendment's due process clause prevents the forfeiture of the instrumentality of a crime without a showing of culpability on the part of the owners. Some forfeiture statues (e.g., 21 USC 881, 1989 Oregon Laws Chapter 791, both re drug-related forfeitures) provide for an "innocent owner" defense to forfeiture, but the Supreme Court doesn't seem to think that's required as a matter of constitutional law. Fed.Rul.Crim.Pro 41(b)(3) allows the seizure of "property designed or intended for use or which is or has been used as the means of committing a criminal offense". There's an excellent resource available re computer search & seizure at <http://www.epic.org/security/computer_search_guidelines.txt> - it's the US DOJ's "Guidelines for Searching & Seizing Computers", pried loose by an EPIC FOIA request and scanned. But there's a big difference between "seizure" and "forfeiture". It's possible that recent legislation has done for computer crime what the drug forfeiture laws have done with respect to title in property - 21 USC 881(h) indicates that "All right, title, and interest in property described in subsection (a) of this section [e.g., property used in connection with a drug crime] shall vest in the United States upon commission of the act giving rise to forfeiture under this section." Given the innocent owner defenses available in an 881 forfeiture, (h) sounds scarier than it works out to be. So yes, there may be a statute which gives title to the government in computers used to commit crimes, and no, the Supreme Court won't necessarily care about an "innocent owner". (Then again, it may make a difference if we're talking about a computer owned by a corporation with political clout, instead of the half-owner of a $600 car used for surreptitious blow jobs. Your cynicism may vary.) I can't seem to find any such statute, but like Ben Laurie pointed out w.r.t. security reviews, there's a line between what folks are willing to do for free, and what feels like work. Digging through a lot of teeny type in the Federal Register/Congressional Record isn't my idea of a good time, so I'll leave the "is there a statute?" question for someone else. I poked around on EPIC's web site and thomas.loc.gov and in 18 USC without finding a computer crime seizure statute, but I may just be too tired. :( At 07:26 PM 11/29/96 +0000, Attila wrote: > I got tired of paying Lexus $150 for idle months after dumping > West for almost $500/month --otherwise I would run down the Feds > kangaroo ruling which seems to grant them this absurd right. > Several on the list are still maintaining accounts... ? > > ====== begin forwarded text ====== > >Computer Attacks Show New Patterns > >The major trends in computer break-ins involve denial of service >and data-driven attacks, says a Department of Justice lawyer. >Denial of service occurs when an attacker "bombs" an Internet >service provider with so many e-mail messages that the server >becomes overloaded and shuts down. Data-driven attacks occur when >a virus program is disguised as a data-only file. The file can be >hidden in a Java program on a Web page, and when a visitor clicks >on the site, he or she unwittingly downloads the virus. A computer >crime consultant with SAIC warns that these attacks can be launched >on an innocent party's Web server, but once that happens, the server >can become the subject of a wiretap and a search warrant. "The title >of your computer vests with the government as soon as a hacker uses >it to commit a crime," he says. > >[BNA Daily Report for Executives 25 Nov 96 A20] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMp+GSv37pMWUJFlhAQHEmgf+IfYnc0w47Ja/ETFlt08uHA7OWV9NJetd l3gA4av00CwST1FRtdizAC0C4t2MHT6kzHb1j8NzncazAvgjdTEa9Vd31UTR0HgU 4dYbu9e+YtYT6NcaD4HszewxVo/gfpUKBobOA2lVe1QLR1Dzqbx2cbsmxKgDsdzE Y/TATalZ7c7BkAXJBBgmXs8QYpsBWGUpmf8PUB3731MpGyF6H4gpmssxefjvGghE eQ27k3hkPlZiKGI5MeZrFhUZXJj3VPu4B3/gC+ZFm2M8Jh4z5Wo4r7w690eb9hky dGkUzQOb6sdh3ee1oJzwNWXE7R6DCL+3uiGA8Slt0hPOSBo2LBY2Zg== =dQn5 -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: More anonymous hate mail from John Gilmore, Timmy May, and
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Ross Wright" <rwright(a)adnetsol.com> writes: > On or About 28 Nov 96 at 15:21, Dr.Dimitri Vulis KOTM wrote: > > > because Americans are so stupid. > > Come on, doc. That's a bit of a generalization. You don't want to > piss off people who like you, now, do you? Hi Ross - well, generally, I think most people are stupid, irrespective of their ethnicity. I'm just trying to piss off some more c-punks. :-) OK, OK, point taken, I'll desist. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

No Subject
by Juan Manuel 17 Dec '03

17 Dec '03

sign-off -- JUAN MANUEL RICO CIUDAD DE PANAMA - PANAMA HTTP://www.paramar.com/index.html mailto:jmro@paramar.com mailto:info@paramar.com PARAMAR IMPORT & EXPORT, LTDA. SERVICIO DE PRIMERA CLASE A SU CARGA TEL: 507 2239836 - FAX: 507 2239837 --

1 0

Re: Re[2]: Sound card as a random number source ??
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> And what if I will use FM receiver, tuned on some channel where is the noise. > If the potentional attacker don't know the what channel was tuned, he is not > able to reproduce this IMHO. Of course, maybe it is possible to record the whole > spectrum to tapes, but I think that the noise will change when recorded and > played back from tape. It might possibly be random enough, especially if you use a tape recorder of a reasonably poor quality, thus inducing wow and flutter noise to the recording before it is sampled. anyone else care to comment? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Announcement: Very Good Privacy
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear Sir, > I'm not sure how an encryption product that uses encryption > algorithms weaker than Pretty Good Privacy can be described > as being better than PGP. > > Especially when all the algorithms listed have known problems > of one kind, or another. << And yes, I know that the known > problems -- in some instances --- are entirely theoretical in > nature. >> What puzzles me is that he included two cyphers that are _extremely_ easy to break, the vignere cypher and the ascii cypher. Why include these? And what is his new permutation of RC4 and DES? Yours Sincerely, Benjamin Grosman

1 0

Strong-crypto smart cards in Singapore and Germany
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Wednesday's "Straits Times" contains two front-page articles on the introduction of a CashCard which acts as an electronic wallet capable of storing from $10-$200 ("Dr Hu launches cash-in-a-card payment system"), and an identity card capable of Internet electronic transactions with (presumably RSA) 1024-bit encryption ("50,000 to take part in electronic ID trials"). The ID card can also be implemented as software on disk. It appears to be purely a form of storing an ID which is then transmitted in encrypted form. The CashCard, on the other hard, is an electronic wallet developed by a group of Singapore banks. There are no details on how it works, except that it doesn't have any sort of protection - it's up to you to make sure the card isn't stolen. The standardisation committee of the German banks have also produced an electronic wallet which should have 25 million (yes, 25M) users by January of next year. Again, this is a pure electronic wallet, with 2-key triple DES and 768-bit (to become 1024-bit) RSA encryption. The relevant standards are still in the process of being translated, but should be available Real Soon Now (the complete specification will be made public). This looks like a very nice system, and unlike Mondex doesn't rely entirely on the hope that criminals can't get at the data on the card. Peter.

5 4